Microsoft Paint vulnerability enables remote code execution (CVE-2026-83844)
Original title: Microsoft Paint Vulnerability Allows Hackers to Execute Malicious Code Remotely Without User Interaction
An out-of-bounds read in Windows Paint build 11.2609.401.0 lets unauthenticated attackers execute code remotely without interaction.
Microsoft disclosed CVE-2026-83844, a memory-safety weakness (CWE-125) in Windows Paint. Attackers can trigger remote code execution by sending crafted packets with no user interaction required. The flaw carries an Important severity rating and CVSS 3.1 base score of 8.1 with high impacts across confidentiality, integrity, and availability. Microsoft lists build 11.2609.401.0 as the affected version and notes exploitation was assessed as less likely at disclosure.
- No user interaction needed
- CVSS base score 8.1
- Exploitation maturity: Unproven
- Affected build: 11.2609.401.0
- Temporal score: 7.1
Impact: Remote code execution without interaction
| Product | Affected |
|---|---|
| Microsoft Paint | build 11.2609.401.0 |
- 1.Upgrade to build 11.2609.401.0
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-83844 | Network RCE via out-of-bounds read in Windows Paint | 7.0 | <1% | PoC ×7 |
From the original article
2 min read at gbhackers.com
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious code remotely without any user interaction. This vulnerability is tracked as CVE-2026-83844 and was disclosed on October 13, 2026. It carries an “Important” severity rating from Microsoft, and its CVSS 3.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.